Popper.js maintainer here, we haven't been compromised. They just injected the malware in that position but the malware didn't come from our npm release